CVE-2025-58434

{"id": "CVE-2025-58434", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58434", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-12T18:10:37.792799Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FlowiseAI", "product": "Flowise", "versions": [{"status": "affected", "version": "<= 3.0.5"}]}]}], "published": "2025-09-12T18:15:34.847", "references": [{"url": "https://github.com/FlowiseAI/Flowise/commit/9e178d68873eb876073846433a596590d3d9c863", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wgpv-6j63-x5ph", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud service (`cloud.flowiseai.com`) and self-hosted/local Flowise deployments that expose the same API. Commit 9e178d68873eb876073846433a596590d3d9c863 in version 3.0.6 secures password reset endpoints. Several recommended remediation steps are available. Do not return reset tokens or sensitive account details in API responses. Tokens must only be delivered securely via the registered email channel. Ensure `forgot-password` responds with a generic success message regardless of input, to avoid user enumeration. Require strong validation of the `tempToken` (e.g., single-use, short expiry, tied to request origin, validated against email delivery). Apply the same fixes to both cloud and self-hosted/local deployments. Log and monitor password reset requests for suspicious activity. Consider multi-factor verification for sensitive accounts."}, {"lang": "es", "value": "Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo de modelo de lenguaje grande personalizado. En la versi\u00f3n 3.0.5 y anteriores, el endpoint 'forgot-password' en Flowise devuelve informaci\u00f3n sensible, incluyendo un 'tempToken' v\u00e1lido de restablecimiento de contrase\u00f1a, sin autenticaci\u00f3n ni verificaci\u00f3n. Esto permite a cualquier atacante generar un token de restablecimiento para usuarios arbitrarios y restablecer directamente su contrase\u00f1a, lo que lleva a una toma de control completa de la cuenta (ATO). Esta vulnerabilidad se aplica tanto al servicio en la nube ('cloud.flowiseai.com') como a las implementaciones de Flowise autoalojadas/locales que exponen la misma API. El commit 9e178d68873eb876073846433a596590d3d9c863 en la versi\u00f3n 3.0.6 asegura los endpoints de restablecimiento de contrase\u00f1a. Varias medidas de remediaci\u00f3n recomendadas est\u00e1n disponibles. No devolver tokens de restablecimiento ni detalles sensibles de la cuenta en las respuestas de la API. Los tokens solo deben entregarse de forma segura a trav\u00e9s del canal de correo electr\u00f3nico registrado. Asegurar que 'forgot-password' responda con un mensaje de \u00e9xito gen\u00e9rico independientemente de la entrada, para evitar la enumeraci\u00f3n de usuarios. Requerir una validaci\u00f3n fuerte del 'tempToken' (por ejemplo, de un solo uso, caducidad corta, vinculado al origen de la solicitud, validado contra la entrega por correo electr\u00f3nico). Aplicar las mismas correcciones tanto a las implementaciones en la nube como a las autoalojadas/locales. Registrar y monitorear las solicitudes de restablecimiento de contrase\u00f1a para detectar actividad sospechosa. Considerar la verificaci\u00f3n multifactor para cuentas sensibles."}], "lastModified": "2026-09-30T17:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DE0B76C-5FFA-40E2-87E1-5C520E387AF0", "versionEndExcluding": "3.0.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}